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FEDERAL BUREAU OF INVESTIGATION 


Precedence : ROUTINE 

To : Cyber 

San Francisco 


Date: 

Attn: CCU-2 SSA 


06/12/2012 


b6 

b7C 


From: San Francisco 

Squad CY2/Sar^ Jose Resident Aaencv 
Contact : SA 


Approved By: 


Drafted By: [ 
Case ID #: 


^I3jsm^~ 



b6 

b7C 


b7E 


Title: UNSUB(S), 

UGNAZI; 

GOOGLE INC. - VICTIM, 
CLOUDFLARE - VIC TIM, 

I I - VICTIM; 

COMPUTER INTRUSION 

Synopsis: To open case and subfiles. 


Detail s: On June 8, 2012 Sup 

I la nd Special Agent (SA)H 


ervisorv Special 


Agent (SSA. l 
H interviewe 


1 Investigator, Trust and Safety , te lephone number [ 




b6 

b7C 


b6 

b7C 


Jemail address 


and[ 


] Corporate 


Counsel, at their place of employment, Google Inc., 1965 
Charleston Road, Mountain View, California , Afte r being advised 


of the identity of the interviewing Agents 
following information: 


provided the 


advised that the information being provided by 


Google was in response to the subjects who compromised Googl e 
Accounts belonging to t he company CloudFlare and their r I 
I I stated that CloudFlare had also discussed 

this matter publicly on its blog. It appeared that on June 1, 


b6 

b7C 















UNCLASSIFIED 



San Francisco 
12/06/2011 


_ | accou nt to obtain access to the 

I account, which was an administrator for 
cloudflare.corn's Google Apps account. 

_ I st ated that the subjects compromised the 

I account by initiating Google's account recovery 
procedures for the account. One of the account recovery options 
was to receive a voice call to a recovery telephone number that 
the user had previously associated with the account. The voice 
call provides the user with a unique code that can be used to 
regain access to the account. 

According to CloudFlare's blog post, the subjects 
instructed Google's system to send a voice call to the cell phone 
listed as the recovery numb er on th e I I account, 

I Acco rding to I I on his blog, the voicemail 

associated with the I f telephone number was 

compromised. l also mentioned that he received an in coming 

call on his cell phone from telephone numbe r I I The 

Google records showed that tel ephone number I I was 

associated with th e subjects. | Iadvis ed that the subjects 

placed a call from | | to I I s cell phone shortly 

before the incoming voice call from Google's account recovery 
system thereby forcing the call from Google to the compromised 
voicemail box. 

_ I 1 advise d that once the subjects obtained access to 

the I |account, the subjects attempted to lock 

1 out of the account by changing the password, secondary 
email address, a nd SMS r ecovery telephone number on the account. 
The subjects and l I fought for control of the account until 

Google staff di sabled th e account and provided access to the 
account back to I 

_ I Ist ated that while the subjects had access to the 

I account. they used that access to compromise 
the I I account bv requesting that a password 

reset link fori be sent to the secondary 

ema il I U nlike the I |account, 

the I | account was configured to use Google's 

2-step verification feature. However, a now-fixed flaw in the 
account recovery flow for Google Apps accounts allowed the 
subjects to bypass 2-ste p verification and compromise the 
i kccount. 
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To: Cyber From: San Francisco 

Re: I | 12/06/2011 b7E 


Once the subjects had access to I I s Google Apps 

account, they used that access to compromise other C loudFlare 
Google Apps accounts, including!| According to 
CloudFlare, the sub jects used their access to moairy proxy 
settings for i I CloudFlare published two blog posts about 

the incident71 I said the blog posts could befound at _ 


|_|advised that Google's investigation found that 

the subjects ma y have compromis ed other Google Accounts, in 
addition to the I I / CloudFlare accounts. In some 

cases, the subjects made unsuccessful recovery claims on Gmail 
accounts. 


It is re queste d that the following subfiles be opened 
and assigned to SA | ~~| 

GJ Grand Jury Materials 

1AGJ Grand Jury 1A Materials 


In view of the above, it is requ ested that a new 
matter be opened and assigned to SA | | 
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File Number 

Field Office Acquiring Evidence J2 

Serial # of Originating Document_ 

Date Received 


ame of Contributor/Intervi&wee) 


(City and State) 


To Be Returned □ Yes 

□ No 

Receipt Given □ Yes □ No 

Grand Jury Material - Disseminate Only Pursuant to Rule 6 (e) 

Federal Rules of Criminal Procedure ' v 

□ Yes 

□ No ' , 

Federal Taxpayer Information (FTI) 

i 

□ Yes 

□ No 

Title: 


Reference: 

- 

(Communication Enclosing Material) 















O' 
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Field Office Acquiring Evidence _ 

Serial # of Originating Document. 

Date Received 
« 1 

From 


6f 




(Name of Contributor/Intervievvee) 


(Address) 


(City and State) 


By 


/ To Be Returned □ Yes Cf No 

Receipt Given Cl Yes 0 No 

Grand Jury Material - Disseminate Only Pursuant to Rule 6 (e) 
Federal Rules of Criminal Procedure 

□ Yes DTNo 

Federal Taxpayer Information (FTI) 

1 □ Yes (Yno 

Title: 

USN 

Cex&L& TWK-" 


Reference: 


(Communication Enclosing Material) 


Description: O Original notes re interview of 
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U.S. Department of Justice 


V 




Federal Bureau of Investigation 


In Reply, Please Refer td 
File No. 


450 Golden Gate Avenue, 

San Francisco, California 94102 
(415) 553-7400 


June 13, 2012 


b7E 


USA Melinda L. Haag 
United States Attorney 
Northern District of California 
450 Golden Gate Avenue 
San Francisco, California 94102 


Attn: AUSA |_| 

San Jose United States Attorney's Office 

UNSUB(S), 

UGNAZI; 

GOOGLE INC. - VICTIM, 
CLOUDFLARE - VIC TIM, 

|- VICTIM; 

COMPUTER INTRUSION 


b6 

b7C 


b6 

b7C 


Dear USA Haag: 


In June of 2012, the San Francisco Division received 
information from Google, Inc. regarding an investigation 
involving a group of individuals who compromised various Google 
Accounts, including accounts that belongin g to the company 
CloudFlare and the i d I | Google also stated 

that CloudFlare posted information regarding the compromise on 
their blog. 


CASE PREDICATION 


On approximately June 1, 2012, unknown in dividual (s) 
compromised the pers onal Google Account operated by 
I t which wa s listed as the secondar y email on 

I I s Google Ados account I I . The 


subjects used their access to thef 
obtain access to the[ 


administrator for cloudflare.com's Google Apps account. 


[ account to 
Jaccount, which was an 


_ Google infor med the FBI that the subjects compromised 

the | | account by initiating Google's account 

recovery procedures for the account. One of the account recovery 
options was to receive a voice call to a recovery telephone 
number that the user had previously associated with the account. 
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The voice call provides the user with a unique code that can be 
used to regain access to the account. 

According to CloudFlare's blog post, the subjects 
instructed Google 1 s system to send a voice call to the cell phone 


listed as the r ecovery numb er on th e 


Acco rding to 
associated with the [ ~ 


] account. 


_ i on his blog, the voicemail 

Dtelephone number was 


compromised. I 1 also mentioned that he received an inc oming 

call on his cell phone from telephone numbe r I I The 


was 


Google records showed that telephone number[ 

associated with th e subjects. G oo gle advi sed that the subjects 
placed a call from ! I toQ * 


s cell phone shortly 
s account recovery 


before the incoming voice call from Google 1 
system, thereby forcing the call from Google to the compromised 
voicemail box. 


b6 

b7C 


to the 


[ 


Google advised that once the subjects obtained access 
] account, the subjects attempted to lock 


out of the account by changing the password, secondary 


email address, a nd SMS r ecovery telephone number on the account. 
The subjects and I I fought for control of the account until 

Google staff di sabled t he account and provided access to the 
account back to I ' 


While the subjects had access to the 


account, they used that access to compromise the 
I laccount by requ esting that a password 


Unlike the|_ 


be sent to the se condary 

]account, 


reset link fori 

ema il | _ 

the | 1 account was configured to use Google's 

2-step verification feature. However, a now-fixed flaw in the 
account recovery flow for Google Apps accounts allowed the 
subjects to bypass 2-st ep verification and compromise the 
I I account. 


Once the subjects had access to 


] s Google Apps 


account, they used that access to compromise other C loudFlare 
Google Apps accounts, including I I According to 

CloudFlare, the subjects used their access to modify proxy 


settings for[ 
the incident 


CloudFlare published two blog posts about 
Gooale stated the blocr costs could be found at 


b6 
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b6 

b7C 


b6 

b7C 



Google's investigative team also discovered that the 
subjec ts mav have comp romised other Google Accounts, in addition 
to the l I / CloudFlare accounts. In some cases, the 

subjects made unsuccessful recovery claims on Gmail accounts. 


2 



















U.S. Department of Justice 



Federal Bureau of Investigation 


In Reply, Plpagp Ppfpr tr> 
File No. 


450 Golden Gate Avenue 

San Francisco, California 94102 

(415) 553-7400 

June 13, 2012 


USA Melinda L. Haag 
United States Attorney 
Northern District of California 
450 Golden Gate Avenue 
San Francisco, California 94102 


Attn: AUSA 


San Jose United States Attorney's Office 


UNSUB (S) , 

UGNAZI; 

GOOGLE INC. - VICTIM, 
CLOUDFLARE - VIC TIM, 

- VICTIM; 

COMPUTER INTRUSION 


Dear USA Haag: 

Pursuant to the above captioned investigation, the 
Federal Bureau of Investigation (FBI) requests that the below 
listed individuals be placed on the Federal Grand Jury 6E list, 
in as much as they may require access to Grand Jury information 
during the course of the investigation: 
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FEDERAL BUREAU OF INVESTIGATION 


Date of transcription 06 715 /2012 


On June 14, 2012, Spec ial Agent (SA) 
served a Preservation Request on I ~ 


b6 

b7C 

b7E 


The Preservation Reques t requested all records and o ther 
evidence be preserv ed for 90 days I I 


A copy of the preservation request, facsimile cover page 
and facsimile verification report are attached and made a part of 
this document. 


. b6 
b7C 
b7E 


Investigation 

on 06/14/2012 

at 

Campbell, California 

File i 


Date dictated not dictated 

by _ 

SA 


2^ 


This document contains neither recommendations nor conclusions of the FBI. It is the property of the FBI and is loaned to your agency; 
it and its contents are not to be distributed outside your agency. 

L_ _ 
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U.S. Department of Justice 



Federal Bureau of Investigation 


450 Golden Gate Avenue 
San Francisco, CA 94102 
(415)553-7400 

June 14, 2012 


RE: Preservation Request 
Dear Custodian of Records: 


In Reply, Please Refer to 
File No. 


that 


e Federal Bureau of Investigation (FBI) is requesting 
take all necessary steps to preserve for a period of 
(90) days any and all records and other evidence, _ 


3 : 


ninety . . _ _____ _ _ 

including, but not limited tof 


Title 18, U.S.C. §§ 2703(f) states the following: 

(f) Requirement to preserve evidence - 

(1) In general - A provider of wire or electronic 
communication services or a remote computing service,, 
upon the request of a governmental entity, shall take 
all necessary steps to preserve records and other 
evidence in its possession pending the issuance of a 
court order or other process. 

(2) Period of retention - Records referred to in 
paragraph (1) shall be retained for a period of 90 
days, which shall be extended for an additional 90-day 
period upon a renewed request by the governmental 
entity. 


b7E 


b6 

b7C 

b7E 


The requested information relates to an ongoing, 
official criminal investigation. It is requested that you do not 
disclose the existence of the FBI's interest into this matter 
until you are notified that the investigation has been completed. 
Failure to comply with this request may subject you to criminal 
penalties, including, but not limited to, obstruction of justice 







under Title 18 U.S.C. §§ 1503. As you are aware, disclosure 
could impede the investigation and interfere with the enforcement 
of law. 


Should you have any questions or ne gd additional 
information, ple ase contact FBI Special Agent 
telephone number| ~ 


at 


Sincerely, 


Stephanie Douglas 
Special Agent in Charge 


m 


Supervisory Special Agent 
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FACSIMILE COVER SHEET 


PRECEDENCE 


C Immediate 


C Priority 
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Routine 

CLASSIFICATION 

C Top Secret C 

Secret 

C Confidential 

C Sensitive 


<• Unclassified 

TO 

Name of Office: 



iFacsimile Number: 


Date: 




i 



06/14/2012 

Attn: 

Online Services Custodian of Records 

Room: 

Telephone Number: 


FROM 


Name of Office: 

FBI 

Number of Pages: (including cover) 

3 

Oric 

SA 

inator's Name: lOrininai-nr'c: Telenhnnp Wumh^r* 


Originator’s Facsimile Number: 

408-558-3977 




Approved: 


__ DETAILS 

Subject: 

Preservation Request 


FD-448 

Revised 

10-27-2004 



Brief Description of Communication Faxed: 


WARNING 

Information attached to the cover sheet is U.S. Government Property. If you are not the intended recipient of this information disclosure, 
reproduction, distribution, or use of this information is prohibited (18.USC, § 641). Please notify the originator or local FBI Office 
immediately to arrange for proper disposition. 
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FEDERAL BUREAU OF INVESTIGATION 


Date of transcription 06/15/2012 


On June 14, 2012, Spec 
served a Preservation Request on 

ial Aaent_(SAL 



1 1 



b6 

blC 

b7E 


The Preservation Request re quested all records and other 


evidence be preserved for 90 days for 


1 





b6 

b7C 

b7E 


A copy of the preservation request, facsimile cover page 
and facsimile verification report are attached and made a part of 
this document. 


investigation on 06/14/2012 at Campbell, California 

File # 

by _ 


Date dictated not dictated 

SA 



fc_,_ 


This document contains neither recommendations nor conclusions of the FBI. It is the property of the FBI and is loaned to your agency; 
it and its contents are not to be distributed outside your agency. 
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U.S. Department of Justice 



Federal Bureau of Investigation 


450 Golden Gate Avenue 
San Francisco, CA 94102 
(415)553-7400 

June 14, 2012 


In Reply, Please Refer to 
File No. 


b7E 


RE: Preservation Request 


Dear Custodian of Records: 


that 


JEji 


e Federal Bureau of Investigation (FBI) is requesting 
take all necessary steps to preserve for a period of 
days any and all records and other evidence. 


ninety(90) 
including, but not limited to [ 


b7E 


b6 

b7C 

b7E 


Title 18, U.S.C. §§ 2703(f) states the following: 

(f) Requirement to preserve evidence - 

(1) In general - A provider of wire or electronic 
communication services or a remote computing service, 
upon the request of a governmental entity, shall take 
all necessary steps to preserve records and other 
evidence in its possession pending the issuance of a 
court order or other process. 

(2) Period of retention - Records referred to in 
paragraph (1) shall be retained for a period of 90 
days, which shall be extended for an additional 90-day 
period upon a renewed request by the governmental 
entity. 








The requested information relates to an ongoing, 
official criminal investigation. It is requested that you do not 
disclose the existence of the FBI's interest into this matter 
until you are notified that the investigation has been completed. 
Failure to comply with this request may subject you to criminal 
penalties, including, but not limited to, obstruction of justice 
under Title 18 U.S.C. §§ 1503. As you are aware, disclosure 
could impede the investigation and interfere with the enforcement 
of law. 

Should you have any questions or ne ed additional _ 

information, ple ase contact FBI S pecial Agent I at 

telephone number 


Sincerely, 


Stephanie Douglas 
Special Agqnt in Charge 
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Compliance Team 
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b7E 


FROM 


Name of Office: 

FBI 

Number of Pages: (including cover) 
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Approved: 
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Preservation Request 


Special Handling In structions: 

Please contact! 


for any questions ati 
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Brief Description of Communication Faxed: 


WARNING 

Information attached to the cover sheet is U.S. Government Property. If you are not the intended recipient of this information disclosure, 
reproduction, distribution, or use of this information is prohibited (18.USC, § 641). Please notify the originator or local FBI Office 
immediately to arrange for proper disposition. 
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FEDERAL BUREAU OF INVESTIGATION 



The Preservation Request re quested all records an d other 

erved for 90 days for I b6 

b7C 
b7E 

A copy of the preservation request, facsimile cover page 
and facsimile verification report are attached and made a part of 
this document. 





This document contains neither recommendations nor conclusions of the FBI. It is the property of the FBI and is loaned to your agency; 
it and its contents are not to be distributed outside your agency. 
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Federal Bureau of Investigation 


In Reply, Please Refer to 45 0 Golden Gate Avenue 

FlleNo ' San Francisco, CA 94102 

(415)553-7400 

June 14, 2012 


RE: Preservation Request 
Dear Custodian of Records: 


The Federal Bureau of Investigation (FBI) is requesting 
that| |take all necessary steps to preserve for a period of 
ninety H?0) days any and all records and other evidence. 
including, but not limited to 


Title 18, U.S.C. §§ 2703(f) states the following: 

(f) Requirement to preserve evidence - 

(1) In general - A provider of wire or electronic 
communication services or a remote computing service, 
upon the request of a governmental entity, shall take 
all necessary steps to preserve records and other 
evidence in its possession pending the issuance of a 
court order or other process. 

(2) Period of retention - Records referred to in 
paragraph (1) shall be retained for a period of 90 
days, which shall be extended for an additional 90-day 
period upon a renewed request by the governmental 
entity. 
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b6 

b7C 
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The requested information relates to an ongoing, 
official criminal investigation. It is requested that you do not 
disclose the existence of the FBI's interest into this matter 
until you are notified that the investigation has been completed. 
Failure to comply with this request may subject you to criminal 
penalties, including, but not limited to, obstruction of justice 
under Title 18 U.S.C. §§ 1503. As you are aware, disclosure 
could impede the investigation and interfere with the enforcement 
of law. 


Should you have any questions or ne ed additional 
information, ple ase contact FBI. Special Agent 
telephone number I 


at 


b6 

b7C 


r 





Sincerely, 


Stephanie Douglas 
Special Agent in Charge 


M 


supervisory speeiai Ageht 


b6 
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FBI 

Number of Pages: (including cover) 
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_lOriqinator's Telephone Number: 1 
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Subject: 

Preservation Request 


FD-448 

Revised 

10-27-2004 


Special Handling In structions: 

Please contact 


for any questions at 


or 
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FEDERAL BUREAU OF INVESTIGATION 


Date of transcription 06/15/2012 


On June 14, 2012, Spec ial Agent (SA) I _ 

served a Preservation Request on I I 


b6 
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t 



evidence 


The Preservation Request re quested all records and other 


be preserved for 90 days for 





b6 

b7C 

b7E 


investigation on 06/14/2012 at Campbell, California 

File # 

Date dictated not dictated 

by SA 






This document contains neither recommendations nor conclusions of the FBI. It is the property of the FBI and is loaned to your agency; 
it and its contents are not to be distributed outside your agency. 
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U.S. Department of Justice 
Federal Bureau of Investigation 


In Reply, Please Refer to 
File No. 


450 Golden Gate Ave. 

San Francisco, CA 94102 
(415) 553-7400 
June 14, 2012 


b7E 


Attention: Custodian of Records 

Re: Preservation request 

Dear Legal Compliance Department: 

Pursuant to Title 18, United States Code, Section 
2703(f) you are hereby directed to take all steps necessary to 
preserve all records and other evidence in the possession of 
for the following: 

I b6 

b7C 

b7E 








Such records and evidence include, but are not limited 



This request is made in anticipation of an appropriate 
Order requiring the production of all information (including 
content) pursuant to the Electronic Communication Transactional 
Records Act, 18 U.S.C. § 2701, et seq. Under Section 2703(f), ■ 
you are required to preserve these items for a period of 90 days. 
This period is subject to renewal. 

Please be advised that your failure to comply with this 
request may subject you to criminal penalties, including, but not 
limited to, obstruction of justice under 18 U.S.C. § 1503, et 


Because this request in being made pursuant to an 
official criminal investigation, you are requested not to 
disclose this request, or its contents to anyone. 

If you have any questions or n eed additional 
information, pl ease contact Spe cial Agent |~ I at 

telephone number or fax number (408)558-3977. 


Sincerely, 


Stephanie Douglas 
Special Agent in Charge 


By: 

Supervisory Specia. 


Agent 
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FEDERAL BUREAU OF INVESTIGATION 


Date of transcription 06/18/2012 


On June 11, 2012, Feder al Bureau of In vestigation (FBI) 
Staff Operations Specialist (SOS) I ~~l conducted open 

source searches and reviewed subscriber information provide bv 
,Google on tfre following email accounts;! I 
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Investigation on 
File # 


06/18/2012 at Campbell, California 


b7E 


Date dictated 


SOS 






This document contains neither recommendations nor conclusions of the FBI. It is the property of the FBI and is loaned to your agency; 
it and its contents are not to be distributed outside your agency. 
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Continuation of FD-302 of 


,On 06/18/2012 



.s the subscribe r to I _ 

emap .1 account, _ 

Account I _ I is subscribed to_ 

_ L The se condary em ail address l isted 

on all three accounts, ! I belongs tol | Open 

source searches confirmed both l I s Twitter 

accounts were compromised on June 3, 2 012 by UNDERGROUND NAZI_ 

HACKTIVIS T GROUP (UGNAZ I). UGNAZI tweeted telephone number |~ I 

_| to l J s followers. In addition, UGN AZI changed the 

SMS telephone number onl Is email account to I " ! 
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Continuation of FD-302 of 


,On 06/18/2012 ,Pa 



number I 


Information could not be located for account 

3 however, | | and SMS 

Mas identified as belonging to account 
_I ACS searches were negative concerning 



_ Ac c our 

I ac count 
located on 
negative. 


_| is associated with| 

No other inform ation could be 
I ~ I. ACS searches were 
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IF) (FBI) 


From: 

Sent: 

To: 

Cc: 

Subject: 


t in (FBI) 

Wednesday. June 27. 2012 9:52 AM 
-HOF) (FBI) 

-1 (IF) (FBI) 

IC3 complaint on UGNazi and email addressf 



]@gmail.com 


b6 

b7C 


Classification: UNCLASSIFIED 


RECORD: 


On 06/27/2 012, MP/j 
office and S/[ 



]and SA[ 


forwar ded the attached complaint to Sa[[ 
]with the San Francisco field office. 


with the New York field 


The complaint is on the Anonymous splinter group UGNazi and email addressl 


[Sgmail.com . 


The co mplaint was filed with the IC3 on 0 6/26/2012 by |_ 

numberl | and email address f" jagmaiLcomf 


lot 


_| telephone 

^reported that his gmail account was 


compromised on 05/12/2012 and the subjects used it to take over 23 domains he owns. He reported the subjects' 
domain as ugnazi.com and email address as l |(S)gmail. 


com. 


I 


^reported he was able to recover 17 of the domains. One of the domains he was not able to recover was 


_which he has ow ned for the last 10 years and has received numerous five figure offers for. Therefore, he 

reported he lost $50.00q J~ I stated the subjects transferred his domain from GoDaddy to Internet.bs . He stated 

he and GoDaddy have repeatedly attempted to contact Internet.bs. but they refuse to investigate ! ~l believes 

Internet.bs is involved with the subjects. 


believes th e subject s are targeting high value domains since they went after hia 

-— L 


purportedly hijacked 


from another victim. 


domain and they 


A search of ACS on 


(5)gmail.com found that this email address was mentioned in San Francisco's casq 


which was opened on 06/12/2012. Their case is on UGN azi^ and the victims a re[ 

Ion 


06/14/2012, San Francisco served a preservati on letter tof 
and many others. The case file also mentioned! 

from 

n 


Jalong with£ 


T UrT 
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b6 
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b7E 


|s gmail account. The IC3 r eceived a co mplaint on 6/4/12 

]repo rted that 


□s twitter and gmail accounts were hacked b\ ) ~ along with s website j The complaint was 


previously forwarded to New York and Los Angeles. San Francisco was offered the complaint was available upon 
request. 


New York also has an open case on UGNazi, 


b7E 


Recipients were requested to advise to writer if the information is utilized in their case. 


l 


















IC3 Automatch number 120402-224175. 


Management & Program Analyst 
Cyber Division 

Internet Crime Complaint Center (IC3) 
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